IPScanner – Block Bots, VPNs & Proxies

IPScanner checks each visitor on your server and stops bots before they reach your forms. Real people never see a challenge.

What it stops

• Fake signups and spam registrations

• Comment and contact form spam

• Card-testing bots on WooCommerce checkout

• Login attacks from bots, Tor and proxies

• VPN and proxy traffic where you don’t want it

Where it checks

• Login, registration and password reset

• Comments

• WooCommerce checkout and account registration

• Contact Form 7 and WPForms

• The whole front end (optional)

Verified search engines and AI crawlers always pass. If the API is slow or down, visitors are let in.

External services

io, run by IPScanner. It is required for the plugin to work.

• When a protected form is submitted, or a page is viewed with whole site protection on, the plugin sends the visitor’s IP address, user agent and these request headers: Accept, Accept-Language, Accept-Encoding, Sec-CH-UA and Sec-Fetch headers. It also sends a random request ID and your Site ID when one is set. Endpoint: POST /v1/edge/check. Results are cached on your site for 10 minutes per visitor.

• With a Site ID set, the plugin reads the site’s policy (no visitor data) at most every 30 seconds. Endpoint: GET /v1/sites/{site}/policy.

• When an administrator opens Settings > IPScanner (at most every 5 minutes) or clicks Test connection, the plugin reads the plan and usage of the API key (no visitor data). Endpoint: GET /v1/usage/summary.

• Connect with IPScanner opens https://ipscanner.io/connect/wordpress with this site’s admin URL, home URL, name, plugin and WordPress versions. After you approve, the plugin exchanges a one-time code for the API key and Site ID. Endpoint: POST /api/connect/wordpress/token.

• With “Send plugin usage stats” on (Settings > Advanced; turned on when you connect, since the connect window asks for it), the plugin sends usage events with the API key: connected or disconnected, settings changed (which settings, the mode, protected areas and blocked classes), connection tested, the settings page opened (at most twice a day per tab), plugin updated or deactivated, and once a day the last 24 hours’ totals (checked, blocked, top class) with the PHP and WordPress versions, locale and whether WooCommerce, Contact Form 7 or WPForms are active. No visitor data. Endpoint: POST /api/wordpress/events.

Nothing is sent before you connect or save an API key.

io/terms

io/privacy

com/ipscanner/ipscanner-wordpress